GCP - Service Account Key Creation Burst

Five or more service account keys created by the same principal inside a 1 hour time bucket, indicating potential mass credential generation.